From c96439ecd0b4dc58da3721a48384cde7d3f938e3 Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Thu, 16 Nov 2023 15:26:58 -0800 Subject: [PATCH] devpts: IterDirents has to check offset and return if it is out of range panic: runtime error: slice bounds out of range [124:0] goroutine 136 [running]: panic({0x3ef9e0?, 0xc000848b28?}) GOROOT/src/runtime/panic.go:1017 runtime.goPanicSliceB(0x7c, 0x0) GOROOT/src/runtime/panic.go:154 gvisor.dev/gvisor/pkg/sentry/fsimpl/devpts.(*rootInode).IterDirents pkg/sentry/fsimpl/devpts/devpts.go:342 gvisor.dev/gvisor/pkg/sentry/fsimpl/kernfs.(*GenericDirectoryFD).IterDirents pkg/sentry/fsimpl/kernfs/fd_impl_util.go:224 Reported-by: syzbot+4c8983831b3b9c7feff6@syzkaller.appspotmail.com PiperOrigin-RevId: 583183528 --- pkg/sentry/fsimpl/devpts/devpts.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/sentry/fsimpl/devpts/devpts.go b/pkg/sentry/fsimpl/devpts/devpts.go index f3e5b9c23..107974c65 100644 --- a/pkg/sentry/fsimpl/devpts/devpts.go +++ b/pkg/sentry/fsimpl/devpts/devpts.go @@ -334,6 +334,9 @@ func (i *rootInode) IterDirents(ctx context.Context, mnt *vfs.Mount, cb vfs.Iter i.mu.Lock() defer i.mu.Unlock() i.InodeAttrs.TouchAtime(ctx, mnt) + if relOffset >= int64(len(i.replicas)) { + return offset, nil + } ids := make([]int, 0, len(i.replicas)) for id := range i.replicas { ids = append(ids, int(id))